📝 HTML Entity Encoder/Decoder

HTML entity encoding converts characters that the HTML parser treats as syntax into character references. Browsers decode them back to Unicode text when rendering, so encoded strings can display markup examples, quotes, ampersands and symbols without changing the document structure. The WHATWG HTML syntax defines three character-reference forms: named references such as <, decimal numeric references such as <, and hexadecimal numeric references such as <. The standard's named character reference table maps names like © and € to code points.

This tool encodes text to HTML entities in named, decimal or hexadecimal form and decodes entity-encoded text back to plain characters. Use it to display HTML snippets as text, escape user-supplied text before it lands in HTML body content or a quoted attribute, convert copyright, trademark, currency and typography marks to portable references, decode scraped pages, CMS exports and email templates, and compare the three reference forms.

Supported inputs

• Text: any Unicode text, typed or pasted. The page clears the output for empty or whitespace-only input; the API requires a non-empty text.
• Operation: Encode or Decode, set with the Operation buttons or the API field operation (encode or decode).
• Encoding mode (API field mode, default safe): Safe characters only encodes just <, >, &, " and '; All non-ASCII characters adds every code point above U+007F; Extended adds only U+00A0 to U+00FF (the printable part of the Latin-1 Supplement, including the no-break space), General Punctuation (U+2000 to U+206F), Superscripts and Subscripts (U+2070 to U+209F) and Currency Symbols (U+20A0 to U+20CF). Outside those five reserved characters no ASCII character is ever encoded, spaces and punctuation included.
• Entity format (API field format, default named): Named uses a table of 23 names (<, &, ", ',  , ©, €, — and 15 more) and falls back to a decimal reference for any other character; Decimal writes é; Hex writes é with uppercase digits.
• Decode: recognises those same 23 named references plus any decimal &#NNN; and lowercase-x hexadecimal &#xHHHH; reference. Mode and format are ignored when decoding.

Output

The Output panel shows the converted text with a Copy Result button, and the Analysis panel shows the input length, the output length and the number of entities created (encode) or found in the input (decode); the counter matches every &name; or &#...; shaped token. The API returns JSON with success, the echoed input, operation, mode and format, the converted result, and an analysis object with inputLength, outputLength and entities. The lengths use different units on each path: the on-page panel counts UTF-16 code units, the API counts Unicode code points, so an emoji counts as 2 on the page and 1 in the API response. Invalid JSON, a blank text, an unknown operation, mode or format, or an unexpected field returns HTTP 400 with an error message.

Example

Encoding <a href="/search?q=Tom&Jerry">Tom & Jerry</a> in Safe mode with the Named format gives <a href="/search?q=Tom&Jerry">Tom & Jerry</a> (8 entities), and decoding that string returns the original markup. The formats differ outside ASCII: café … 5€ in All non-ASCII mode becomes café … 5€ (Named), café … 5€ (Decimal) or café … 5€ (Hex); Safe mode leaves it unchanged because it holds no reserved character.

Limitations

• Entity encoding is an output-context control, not an HTML sanitizer. It is the right escaping for HTML text and quoted attributes, not for JavaScript strings, CSS, URLs, event handlers or untrusted HTML you intend to render. For security-sensitive output, combine validation with the context-specific rules in the OWASP XSS Prevention Cheat Sheet.
• The decoder knows only those 23 named references. Other names from the WHATWG table, such as é, ♥ or →, are left as written, while every semicolon-terminated decimal or lowercase-x hexadecimal reference is decoded.
• References without a closing semicolon (&lt, &#60) and hexadecimal references with an uppercase X (<) are not decoded, although browsers accept them.
• Decoding applies the named table, then decimal, then hexadecimal replacements in sequence, so doubly encoded text can decode twice: < becomes < rather than <.
• Numeric references are not validated against the HTML parsing rules. The browser tool emits � and lone surrogates such as � as they are, while the API cannot carry a lone surrogate in its JSON response and fails with HTTP 400. A code point above U+10FFFF raises an error on both paths instead of the U+FFFD replacement a browser would show.
• Named format writes the apostrophe as ', which HTML5 and XML define but HTML 4.01 does not; choose Decimal or Hex for ' or ' when older parsers or email clients must read the output.
• Extended mode covers only the four ranges above, so CJK text, emoji and other symbols pass through unchanged unless you choose All non-ASCII.
• Input is processed on every keystroke, so very large strings can make the page slow.

Browser or server processing

The interactive tool runs in the browser through the shared logic module, so nothing you type here leaves your device. The public API runs the same module on the server and is rate limited, so send secrets through it only if that processing path is acceptable to you.

FAQ

Should I encode quotes in HTML?

Yes whenever the text lands inside an attribute value, because an unescaped " or ' ends the attribute early. Every mode here encodes both quote characters: Named gives " and ', Decimal gives " and '. Inside element text they are harmless, but encoding them does no damage.

Why is   not decoded to a normal space?

  stands for U+00A0 NO-BREAK SPACE, a different character from the ordinary U+0020 space, and the decoder returns that exact code point. It looks like a space but blocks line wrapping and does not match a plain-space search, so replace U+00A0 with a space after decoding if that is what you need. When encoding, U+00A0 becomes   in the All non-ASCII and Extended modes with the Named format, and   or   with the Decimal and Hex formats; regular spaces are never encoded.

Does it encode non-ASCII characters?

Not in Safe mode. All non-ASCII encodes every character above U+007F and Extended encodes the Latin-1, punctuation, superscript and currency ranges; Named format uses the known name where the table has one (©, €, —) and a decimal reference otherwise, so é becomes é. UTF-8 pages rarely need it; it helps when output must survive an ASCII-only channel or a legacy charset.

Why does é stay unchanged after decoding?

The decoder supports 23 common names plus semicolon-terminated decimal and hexadecimal references; other WHATWG names are left as written. Replace them with their numeric form (é for é) or look the code point up in the HTML Entity Reference.

References

• WHATWG HTML Standard: Character references
• WHATWG HTML Standard: Named character references
• OWASP Cross Site Scripting Prevention Cheat Sheet